JetBrains told everyone to patch. It didn’t patch itself.
JetBrains is urging users of its Cadence cloud development service to rotate credentials and treat previous executions and their outputs The post JetBrains told everyone to patch. It didn’t patch itself. appeared first on The New Stack .
JetBrains warned developers to update their credentials and consider all previously executed code as untrusted after a critical TeamCity vulnerability left one of its servers exposed. The company disclosed the CVE-2026-63077 flaw on July 27, but by August 7, attackers were already exploiting unpatched TeamCity servers. The server responsible for JetBrains' cloud computing service, Cadence, was never patched.
Attackers accessed the compromised server between August 8 and August 24, potentially stealing a backup of the server that could have contained sensitive information including credentials, configuration files, and logs. They also compromised multiple AWS IAM users and their associated credentials, accessing files in JetBrands' AWS accounts used by the service.
Developers using the PyCharm plugin could have exposed source code and credentials through Cadence. JetBrains advises users to rotate all credentials, including AWS, Azure, Google Cloud, and package registry credentials, as well as tokens for various platforms like GitHub, GitLab, and Bitbucket. The breach also exposed personal information such as usernames, email addresses, and IP addresses.
JetBrains recommends checking for unexpected changes in source control, cloud environments, and package repositories, as well as verifying the authenticity of any artifacts produced during the compromised period.
Written by urgent.news from The New Stack's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
